Privacy Policy
Last updated: October 24, 2026
What we collect
Account information: your name, email, and a salted hash of your password. If you sign up via Apple or Google, we store the OAuth subject ID and the email returned by the provider.
Financial data you enter: account balances, transactions, bills, budgets, goals, retirement plan details, assets, debts, insurance policies, estate planning entries. We store this because you asked us to — none of it is required to use the free tier.
Bank-linked data: if you connect a bank via Plaid, we receive account balances and transaction history. Plaid tokens are encrypted at rest with AES-256-GCM. We never see or store your bank credentials.
Property tax data: if you look up a property, we query the relevant public records API (currently New Jersey MOD-IV). We cache the returned parcel data so the next lookup is fast. We never request or store property owner names (New Jersey Daniel's Law).
Usage data: if Sentry and PostHog are configured, we collect error reports and aggregate usage analytics. We do not sell data to anyone, ever.
Why we collect it
To provide the household financial planning service you signed up for. Specifically: to display your accounts and transactions, to remind you of upcoming bills and deadlines, to run retirement and scenario projections, to draft estate planning documents, and to improve the product.
How long we keep it
As long as your account is active. You can delete your account at any time from Settings → Danger Zone, which permanently deletes all your data within 24 hours. We retain anonymized audit log entries for 7 years to comply with GLBA record-keeping requirements.
Your rights (CCPA/CPRA for California residents)
You have the right to: know what data we collect (this policy), access your data (Settings → Export), delete your data (Settings → Delete account), opt out of data sale (we don't sell data, but you can confirm by emailing privacy@moneymagic.app), and not be discriminated against for exercising these rights.
Your rights (GDPR for EU residents — out of scope at launch)
MoneyMagic is initially available to U.S. residents only. If we expand to the EU, we will provide a separate GDPR-compliant process for data subject requests.
Data security
Bank tokens encrypted with AES-256-GCM. Passwords hashed with scrypt. HTTPS everywhere. httpOnly session cookies. Rate limiting on auth endpoints. MFA available. SOC 2 Type II in progress. See our security page for details.
Contact
Email privacy@moneymagic.app with questions. We respond within 30 days (CCPA) or as required by your state's law.